Oct. 28, 2020
Dipsy Kapoor
|
A new vulnerability was recently identified in Apache Solr. We want to report this security vulnerability to you, describe how we responded to the incident and reiterate our commitment to constantly improving the security and integrity of our customers’ Solr deployments, data and service.
The new vulnerability has been identified in Solr – CVE-2020-13957. This vulnerability was initially reported on October 13, 2020, and was assessed as a Critical vulnerability on 23rd October with a CVSS score of 9.8.
This blog post describes the vulnerability, offers recommended mitigations for all users and provides specific mitigation steps for SearchStax customers.
Certain Apache Solr are susceptible to a vulnerability which when successfully exploited could lead to disclosure of sensitive information, addition or modification of data, or Denial of Service (DoS).
Apache Solr versions affected:
Specifically, the Apache Solr versions referenced above prevent some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that’s uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.
Any of the following steps are sufficient to prevent this vulnerability:
SearchStax offers both IP Filtering and Solr Basic Authentication to secure your Solr deployments and recommends that both of these Security settings are applied whenever possible.
If you are a SearchStax customer, our team may have already contacted you or will contact you shortly to work with you to make sure your deployments are secure. If you have any other questions about the Solr Vulnerability, please contact SearchStax Support or submit a support ticket.
The Stack is delivered bi-monthly with industry trends, insights, products and more
Copyrights © SearchStax Inc.2014-2024. All Rights Reserved.
SearchStax Site Search solution is engineered to give marketers the agility they need to optimize site search outcomes. Get full visibility into search analytics and make real-time changes with one click.
close
SearchStax Managed Search service automates, manages and scales hosted Solr infrastructure in public or private clouds. Free up developers for value-added tasks and reduce costs with fewer incidents.
close
close